Privacy Policy

1. Who we are

12 Dimensions Studio builds websites and complete online presences for UK professional practices and Indian local businesses. Contact: reach@12dimensions.co. The free 12D Score and the paid 12D Blueprint, Pulse and Radar products — including the AI sources (Perplexity, OpenAI, Google) used for the Score's "What AI says about you" check — are provided at twelvedimensions.co, under its own privacy policy.

2. What personal data we collect

Website visitors

• Aggregate, anonymised traffic data via Cloudflare Web Analytics (no cookies, no personal identification)
• Your cookie-consent choice, stored in a single first-party cookie

People who book a brand review

• Name, email address, business name, city and country, and your answers to the booking questions, collected by Cal.com
• Links you share to your existing website, Google listing or social profiles
• Notes we take during the call

Clients

• Business contact and billing details needed to quote, invoice and deliver the work — for an Indian client, this includes your GSTIN or PAN and a billing address, for the GST invoice. A PAN is stored masked in our admin tools and never shared except as tax law requires
• Content, images and account access you provide so we can build and launch your site. Where we handle personal data belonging to your customers, we do so as a processor under a separate Data Processing Agreement.

People who use the 12-Dimension Score tool

• The URL you submit, and the resulting score, findings and fixes, stored so the result page keeps working
• A one-way, salted hash of your IP address, used only to enforce fair-use rate limits — we never store the IP address itself
• To compute a score, we read the public content of the URL you submit (never anything behind a login) and send it to our AI provider for the rubric assessment and Google PageSpeed for a technical performance check — see section 4

3. Why we collect it and our legal basis

• Legitimate interests: to respond to enquiries, run the brand review, prepare quotations, run the 12-Dimension Score tool and improve our services
• Contract performance: to deliver work you have engaged us for
• Legal obligation: to meet UK GDPR, ICO registration and tax requirements, and Indian law where applicable

4. Who we share data with

We use the following subprocessors, each under GDPR-compliant terms:

• Cal.com — scheduling of brand reviews
• Google Workspace — email, calendar and document storage
• Cloudflare — DNS, web analytics, security, bot-check (Turnstile — see our Cookie Policy), and encrypted database backups (R2)
• Railway — website and database hosting
• GitHub — source-code storage for sites we build
• Anthropic — AI used in producing copy, code and design during a build, and in judging a submitted URL against the 12-Dimension Score rubric; we do not paste your customers' personal data into it
• Google PageSpeed Insights — automated technical performance check as part of a 12-Dimension Score

We do not sell, rent or share your personal data with third parties for marketing.

5. Data retention

• Enquiry and brand-review data: 12 months from last contact, then deleted
• Client account and billing data, including any GSTIN/PAN/address collected for a GST invoice: duration of the engagement plus the period Indian tax law requires us to keep records: currently 84 months after the end of the financial year (April to March) in which the invoice was issued, and longer while a tax proceeding, appeal or reassessment about it is still open (CGST Act 2017, section 36; Income-tax Rules 2026, rule 46).
• 12-Dimension Score results and email subscriptions: 12 months from creation, then deleted; if you unsubscribe, your subscription record is deleted after 30 days rather than waiting out the 12 months. Deleted automatically, every night
• Website analytics: anonymised, retained indefinitely

6. International transfers

We operate from India. Data belonging to UK residents that is transferred to India is protected by our contractual terms with subprocessors and our ICO registration. Where subprocessors are in the United States, we rely on Standard Contractual Clauses or equivalent mechanisms under UK GDPR.

7. Your rights under UK GDPR

You may ask to access, correct or delete your personal data, object to processing based on legitimate interests, withdraw consent, or complain to the ICO at ico.org.uk. Email reach@12dimensions.co; we respond within 30 days.

8. Cookies

See our Cookie Policy.

9. Changes and contact

We may update this policy; the date at the top shows the current version. Questions to reach@12dimensions.co.